Which versions of LlamaIndex are affected by CVE-2024-14021?

LlamaIndex, a widely-used data indexing library for AI applications, contains an arbitrary code execution vulnerability in versions up to 0.11.6 that is triggered when loading maliciously crafted…. A patch is available.

Is there a public PoC exploit available for CVE-2024-14021?

Yes, a public proof-of-concept exploit is available for CVE-2024-14021. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-14021?

Within 24 hours, audit all systems to identify any running LlamaIndex versions 0.11.6 or earlier and assess whether they load untrusted or user-supplied index files. Within 7 days, upgrade LlamaIndex to the latest patched version released by run-llama/llama_index and implement or review access controls limiting which systems and users can write to index persist directories. Within 30 days, complete regression testing in production-equivalent environments to ensure the upgrade does not break dependent components, and conduct a full audit to confirm all affected systems have been successfully patched and are no longer vulnerable.

LlamaIndex CVE-2024-14021

Q: What is the CVSS score of CVE-2024-14021?

CVE-2024-14021 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-01-12 disclosure@vulncheck.com

Deserialization Llamaindex RCE

8.4

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local trusted-input RCE: attacker supplies a malicious on-disk pickle (AV:L) and the victim must load it (UI:R), yielding full C/I/A via code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 23:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 23:22 NVD

7.8 (HIGH) 8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 15, 2026 - 22:39 vuln.today

Public exploit code

CVE Published

Jan 12, 2026 - 23:15 nvd

HIGH 7.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on llama-index (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.11.7.

DescriptionCVE.org

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

AnalysisAI

Arbitrary code execution in LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 occurs when BGEM3Index.load_from_disk() calls pickle.load() on a multi_embed_store.pkl file read from an attacker-controlled persist_dir. A victim who loads a maliciously crafted index directory executes attacker-supplied code in their own process. Publicly available exploit code exists (huntr bounty submission), though EPSS is low (0.08%) and it is not listed in CISA KEV, so there is no public exploit identified as actively exploited.

Technical ContextAI

The flaw sits in the BGE-M3 managed index component (llama_index/indices/managed/bge_m3/base.py), which persists and reloads a multi-embedding store using Python's pickle serialization. Python's pickle format is not a safe data format: deserialization can invoke arbitrary constructors and __reduce__ methods, so unpickling untrusted bytes is functionally equivalent to executing untrusted code. This is a textbook CWE-502 (Deserialization of Untrusted Data) issue - load_from_disk() trusts the on-disk .pkl in a user-supplied persist_dir with no signature, allow-list, or safe-loader validation. The affected code is the LlamaIndex Python package (CPE cpe:2.3:a:llamaindex:llamaindex), a widely used framework for building retrieval-augmented-generation (RAG) and LLM data pipelines.

RemediationAI

Patch available per vendor advisory - upgrade LlamaIndex to a fixed release beyond 0.11.6 (the input does not specify an exact fixed version number, so confirm the patched version against the VulnCheck advisory at https://www.vulncheck.com/advisories/llamaindex-bgem3index-unsafe-deserialization and the project repository at https://github.com/run-llama/llama_index before deploying). Until patched, do not call BGEM3Index.load_from_disk() on any persist_dir that is not fully under your control; treat index directories as executable code. Practical compensating controls: only load indexes generated and stored by your own trusted pipeline, restrict filesystem permissions on persist directories so untrusted users cannot write multi_embed_store.pkl, and verify artifact integrity (checksums/signatures) before loading - the trade-off is added operational overhead and loss of the convenience of loading arbitrary shared indexes. Also review the huntr disclosure (https://huntr.com/bounties/ab4ceeb4-aa85-4d1c-aaca-4eda1b71fc12) for exploit specifics when validating your mitigations.